Google shuts down a botnet of 1.3 million TV boxes infected at the factory

Google and its partners have taken down XCPE, a botnet of more than 1.3 million Android TV boxes, and banned the Chinese company that, according to Google, built it. The malware did not arrive through a bad app or a hack: it was written into the firmware at the factory. Google's Threat Intelligence Group (GTIG) says "with high confidence" that the backdoor was "intentionally developed, deployed, and operated for financial gain" by Videostrong Technology, a manufacturer that makes boxes for many brands. The report was published on 2 November.

A backdoor built in at the factory

The main components, x.cpe and com.oemservice, run with Android system privileges. Through them the operators could silently install apps, turn off Google Play Protect, run commands, take screenshots, simulate key presses and collect account and device data. If the malware is removed, it reinstalls itself from the device's /oem/ partition after a reboot, so a factory reset does not help. Google says the code was built into "many different device models and brands over multiple years" and calls it a deliberate business, not "an isolated rogue insider or a development oversight".

The security firm Synthient, one of the partners, bought a MECOOL KM9PRO Max box in late 2025 and found the malware already installed, BleepingComputer reports. On an open server used by the botnet it also found documents from Videostrong's R&D director, and the backdoors were signed with company email addresses. Most infected devices are TV boxes, but Google also found the backdoor in telehealth devices, karaoke machines and digital signage. The botnet is spread around the world. Google has not published a breakdown by country.

How the boxes earned money for others

According to Google, Videostrong sold access to the backdoor to criminal "affiliates" and loaded their modules onto the boxes. Some turned the devices into exit nodes of residential proxy networks: strangers' traffic went out through the owner's home connection and IP address. Google names Linkfog, AppSalt/Honeygain, GaGaNode, NetNut, Traffmonetizer and others among the proxy services involved. One SDK, Google writes, ticked the consent box itself "without displaying any user interface". Other modules committed ad fraud, loading hidden pages and registering fake ad views, and some installed further backdoors that Google had earlier linked to the BadBox operation.

For the owner this means more than a slow box. Their IP address appears in traffic they never sent, which can lead to captchas, blocked accounts and suspicion over activity they had nothing to do with.

What Google did

With Japan's National Police Agency and the companies Lumen, HUMAN Security, Plume, Synthient and TrendAI, Google took legal action to take down the domains and servers used to control XCPE. It also went after the command servers of more than a dozen malware families loaded through the backdoor, which cuts off at least 10 million more infected devices. Google has ended its relationship with Videostrong and banned it and any future affiliates from making certified Android devices or supplying software to certified vendors. The company admits that Videostrong used obfuscation to slip past certification tests and load malicious code after the first boot, and says it has changed its review process.

How to protect yourself

• Buy TV boxes only from brands on Google's list of certified Android TV partners. Cheap no-name boxes from marketplaces are most at risk. As this case shows, certification is no full guarantee, but it is still the best filter available.
• If you own a MECOOL KM9PRO Max or another box you suspect, a reset will not help: the malware comes back from the system partition. Disconnect it from the internet now and plan to replace it with a certified model: a box that cannot be cleaned is not safe to keep using.
• Keep Google Play Protect on and install apps only from stores you trust.
• Avoid apps that pay you for "unused bandwidth" or "sharing your internet". This is exactly how residential proxies recruit devices.
• Check your router's list of connected devices and its traffic statistics. A box that sends a lot of data while the TV is off is a warning sign. Our guide explains how to check whether a TV box is working for someone else.

This is not the first such case. In the summer, we covered 120,000 Android TV boxes that rented out their owners' home internet and the takedown of the NetNut proxy botnet. XCPE is larger, and in this case Google points at the manufacturer itself.